Fixed Spec and SRPM are here:
http://people.redhat.com/dbhole/fedora/maven2-common-poms/
One note about the spec:
There is no way to generate a tarball easily because a lot of these poms are not
in cvs, yet they are needed for maven2. As more packages move to maven, the poms
will move into those package repos and this package will eventually become obsolete.

Lines marked with X need to be fixed. ? lines should be looked at if
possible.
MUST:
* package is named appropriately
* it is legal for Fedora to distribute this
* license field matches the actual license.
* license is open source-compatible.
* specfile name matches %{name}
X verify source and patches
. we really need to host the source tarball somewhere other than just in the
SRPM. Even just on your people page is fine. The XML file as well.
X skim the summary and description for typos, etc.
. "maven2 dependent" -> "maven2-dependent"
* correct buildroot
* %{?dist} used appropriately
X license text included in package and marked with %doc
. since you're maintaining the source, can you include the ASL text?
* package(s) meets FHS (http://www.pathname.com/fhs/)
* rpmlint on maven2-common-poms-1.0-4jpp.1.fc7.src.rpm gives no output
W: maven2-common-poms non-standard-group Development/Java
. safe to ignore
* changelog fine
* Packager tag not used
* Vendor tag not used
* License used and not Copyright
* Summary tag does not end in a period
* no PreReq
* specfile is legible
* package successfully compiles and builds on at least x86
X BuildRequires are proper
. why the Requires(postun) on jpackage-utils? There's no %postun.
* summary is a short and concise description of the package
* description expands upon summary
* lines are <= 80 characters (except buildroot which is fine)
* specfile written in American English
* no -doc sub-package necessary
* no libraries
* no rpath
* no config files
* not a GUI app
* no -devel necessary
* macros used appropriately and consistently
* no %makeinstall
* no locale data
? consider using cp -p on line 5 of %install
* no Requires(pre,post)
* package not relocatable
* package contains code
* package owns all directories and files
* no %files duplicates
* file permissions okay; %defattrs present
* %clean present
* %doc files do not affect runtime
. adding ASL.txt won't affect this
* not a web app
* final provides and requires sane
* rpmlint on the binary RPMs:
SHOULD:
X package should include license text in the package and mark it with %doc
* package builds on i386
? package builds in mock
. it's just building in mock now ... I don't anticipate a problem

(In reply to comment #2)
> X verify source and patches
> . we really need to host the source tarball somewhere other than just in the
> SRPM. Even just on your people page is fine. The XML file as well.
The md5sums now match.
X Please change the Source0 line to the full URL
> X skim the summary and description for typos, etc.
> . "maven2 dependent" -> "maven2-dependent"
Verified, thanks.
> X license text included in package and marked with %doc
> . since you're maintaining the source, can you include the ASL text?
Can we do this?
> X BuildRequires are proper
> . why the Requires(postun) on jpackage-utils? There's no %postun.
Verified.
> X package should include license text in the package and mark it with %doc
This is the only thing remaining.